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Disclaimer 


This report (“Report”) was prepared by Mazars LLP at the request of the Information Commissioner’s Officer (‘ICO’) and terms for the preparation and scope of the Report have been agreed with 
them. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this 
Report is as accurate as possible, Internal Audit have only been able to base findings on the information and documentation provided and consequently no complete guarantee can be given that this 
Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. 


The Report was prepared solely for the use and benefit of ICO and to the fullest extent permitted by law Mazars LLP accepts no responsibility and disclaims all liability to any third party who purports 
to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its 
contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix A1of 
this report for further information about responsibilities, limitations and confidentiality. 
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01 Introduction 


At the request of management, we have conducted a follow up review to assess progress made by the ICO in implementing agreed internal audit 


recommendations. Further detail of the specific reports reviewed, and our approach are included in Appendix A1. This report summarises our review of 
recommendations only. 


02 Key Findings 
1.1 Summary 


At the time of the Follow Up review in May 2021, there were a total of 25 recommendations that were due for implementation. 


Of these 25 recommendations, based on our testing, we consider all 25 (100% of total recommendations) to be implemented. At the time of the audit, 9 
recommendations were not yet due for implementation. A table showing the results of implementation of recommendations is provided below. 


1.2 Follow Up of Previous Recommendations 


A table showing the results of the implementation of recommendations is provided below. |CO’s implementation rate is 100%. 
1 Fundamental 2 0 2 0 
2 Significant 12 0 12 2 


3 Housekeeping 11 7 


11 0 
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A1 Scope and Objectives of the Audit 


The effectiveness of internal audit relies upon there being a robust process for establishing that audit recommendations have been implemented. The 
purpose of this review has been to establish whether ICO is effectively dealing with recommendations raised. The recommendations from the following audit 
reports were reviewed during this follow up: 


Audit Reports Followed Up 


e High Priority Investigations (2020/21) e Information Governance (2020/21) 

e Methodology of the Business Planning Process (2020/21) e RMS (Stakeholder Management) (2020/21) 

e Fees and Income (2020/21) e Payroll (2019/20) 

e HR Core Controls (2020/21) e Corporate Governance (2019/20) 

e Investigations and Enforcement (2020/21) e Freedom of Information: Complaints and Appeals (2019/20) 


Our approach involved obtaining sufficient audit evidence through sample testing, observation and discussions with management and staff, in order to 
independently confirm the implementation of recommendations. 
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Partner, Mazars 
Peter.Cudlip@mazars.co.uk 


Darren Jones 
Manager, Mazars 
Darren.Jones@mazars.co.uk 


Mazars is an internationally integrated partnership, specialising in audit, accountancy, advisory, tax and legal services*. Operating in over 90 countries and territories around 
the world, we draw on the expertise of 40,400 professionals — 24,400 in Mazars’ integrated partnership and 16,000 via the Mazars North America Alliance — to assist clients of 
all sizes at every stage in their development. 


*where permitted under applicable country laws. 


www.mazars.co.uk 
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